DEBIAN-CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

CVE-2026-88051

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and sizeused from a .traineddata model without a cap or an invariant check. reservereserved allocates the backin...

CVE-2026-88036

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier...

osTicketFileReadIntoRCE

CVE-2026-22200: osTicket 任意ファイル読み取りからRCEへ PHPフィルターチェーンインジェクションとCVE-2024-2961（CNEXT）を組み合わせたフルチェーンエクスプロイト。脆弱なosTicketインストールに対して、認証なしでのリモートコード実行を実現します。 目次 概要 脆弱性の詳細 攻撃フロー 機能 インストール 使い方 技術詳細 トラブルシューティング 検出と緩和策 クレジット 免責事項 概要 このリポジトリは、CVE-2026-22200 （osTicket バージョン ≤ 1.18.2...

CVE-2026-34197

CVE-2026-34197 ActiveMQ Classic セキュリティ検出ツール これは、防御および内部ネットワーク調査向けの Apache ActiveMQ Classic 露出面検出ツールであり、CVE-2026-34197 に関連するリスクの評価を支援します。 このプロジェクトには脆弱性の悪用コードは含まれておらず、Jolokia の exec を実行せず、コネクタを作成せず、リモート XML をロードせず、Broker の状態も変更しません。ツールは読み取り専用の HTTP...

zenml-CVE-2024-2083-POC

CVE-2024-2083 – ZenML 任意文件读取 PoC 本仓库演示了如何复现 CVE-2024-2083 ，即 ZenML 中的任意文件读取漏洞。 该漏洞允许攻击者通过滥用 /api/v1/steps API 请求中的 logs.uri 字段，从服务器文件系统读取文件。通过使用代理修改此值，可以执行路径遍历，从而通过 ZenML 用户界面日志泄露敏感文件。 概述 漏洞编号： CVE-2024-2083 受影响软件： ZenML 影响： 通过路径遍历实现任意文件读取 攻击向量： 操纵 /api/v1/steps API 请求中的 logs.uri 攻击方式为拦截管道运行时生成的...

CVE-2025-7771

一个用 Rust 编写的针对 CVE-2025-7771 的漏洞利用程序 源代码一览 data.rs，将存在漏洞的驱动程序二进制文件存储为静态数组 exploit.rs，基于该存在漏洞的驱动程序实现任意读写原语 filemap.rs，Win32 文件映射操作的简单封装 nt.rs，用 Rust 实现的一些 NT 功能 services.rs，Win32 服务管理（创建/删除、启动/停止/暂停/继续）的简单封装 spf.rs，基于 SuperFetch 实现虚拟地址到物理地址的转换 编译与运行 编译后将得到一个可执行文件，在命令行提示符中运行它，将产生类似如下的输出：...

CVE-2026-89046 zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

CVE-2026-89046 zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize . The root cause is a missing validation of negative srcPosition arguments, which bypass bounds checks and propagate into the native frame-header parser, causing out-of-bounds memory...

CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

EUVD-2026-75635

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser, causing...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 contain a denial-of-service vulnerability in ZstdInputStreamNoFinalizer.read(). The method fails to validate negative length parameters, causing an infinite loop while holding the stream monitor and blocking all other threads from accessing the stream. T...

CVE-2026-88051

Tesseract (open-source OCR engine) versions 5.5.3 and earlier contain a heap out-of-bounds write in the callback form of GenericVector::read (src/ccutil/genericvector.h). The function reads independent reserved and size_used_ int32 fields from a .traineddata model without a cap or invariant check...

EUVD-2026-75627

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and sizeused from a .traineddata model without a cap or an invariant check. reservereserved allocates the backin...

Heartbleed-PoC-Exploit-Script

Heartbleed-PoC-Exploit-Script 此 Python 概念验证（PoC）脚本通过执行带有心跳扩展的 TLS 握手并发送精心构造的心跳请求，检测 Heartbleed 漏洞（CVE-2014-0160）。它解析服务器响应以识别泄露的内存，帮助评估针对此关键 OpenSSL 漏洞的脆弱性。 关于 Heartbleed 是 OpenSSL 的 TLS 心跳扩展中的一个严重缓冲区过度读取漏洞，允许攻击者读取最多 64KB 的服务器内存，可能暴露私钥、密码和其他敏感数据。此脚本模拟一个心跳请求，若服务器存在漏洞，则会触发泄漏。 改进与修复 使用正确的结构体解包来解析 TLS...

apache-cve-2021-41773-lab

Apache 2.4.49 路径遍历实验室 — CVE-2021-41773 克隆 root@kitploit: git clone https://github.com/zubairahm3d/apache-cve-2021-41773-lab.git cd apache-cve-2021-41773-lab chmod +x apachelab.sh 用法 启动存在漏洞的服务器： root@kitploit: ./apachelab.sh choose option 1 手动利用： root@kitploit: curl --path-as-is...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips 任意文件读取 → SECRETKEYBASE 窃取 → RCE 概述 CVE-2026-66066 是一个严重级别（CVSS 9.5）的预认证 任意文件读取到远程代码执行链，存在于 Ruby on Rails Active Storage 中，影响默认配置下的 Rails 7.2.0–7.2.3.1 、8.0.0–8.0.5 和 8.1.0–8.1.3 。 该漏洞利用了跨越 Rails、libvips、libmatio 和 HDF5 的四层解析器混淆...

CVE-2026-88939

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities...